For years, the working assumption in enterprise security was that a newly disclosed vulnerability gave defenders a grace period: days, sometimes weeks, to test a patch, schedule downtime and roll it out. New data from Lumen Technologies suggests that grace period is eroding. In one example the company cites, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.
Lumen released its CISO Update to the 2026 Lumen Defender Threatscape Report on 10th November. It draws on Black Lotus Labs, the company’s threat research and intelligence team, which monitors activity across Lumen’s internet backbone. The update’s central conclusion is that trends flagged earlier this year have accelerated. Threat actors are moving faster, operating at greater scale and recovering quickly from disruption.
“Cybersecurity is a race without a finish line,” said Kim Keever, Lumen’s Chief Security Officer. “Attackers are constantly probing internet-facing infrastructure, quickly shifting to new opportunities and rebuilding resources when they’re disrupted. For security leaders, the takeaway is clear: Reducing exposure and identifying malicious activity earlier in the attack cycle have never been more important.”
Why the disclosure window matters
To see why these numbers matter, it helps to remember how most organisations manage vulnerabilities. Patch cycles are typically built around change-control processes, maintenance windows and testing requirements, all of which assume that attackers need time to understand a flaw, build an exploit and find targets. That assumption is what makes the time between public disclosure and active exploitation one of the most closely watched metrics in security. Every hour that gap shrinks is an hour defenders no longer have to react.
Lumen’s findings suggest the gap is closing from both ends. Attackers are moving quickly once a flaw is public, and they are using automation to apply pressure at a scale that manual operations could not match.
65 million attacks in three weeks
The clearest illustration is a campaign Black Lotus Labs tracked over three weeks. It launched more than 65 million attacks against more than 10,000 Fortinet devices, and the attackers used AI tools to automate the intrusions.
The target selection is notable. Firewalls and VPN appliances sit at the network edge, where they are reachable from the internet by design, and a compromise there can offer a foothold into the wider environment. Automation lets an attacker test thousands of such devices continuously, without the labour that once limited how many targets a campaign could cover. At that pace, the report warns, even a temporary misconfiguration could lead to compromise. A device that is exposed for a few hours during a change window, or a setting that is left open after troubleshooting, may be found and tested before anyone notices.
Constant pressure, regardless of who you are
The Fortinet campaign is one example of a broader baseline. In the first half of 2026, Black Lotus Labs detected nearly 4,000 brute force attacks and exploit scanners per day on average, aimed at firewalls, VPNs and other internet-connected equipment.
According to the report, that volume shows attackers care more about whether a device is exposed than about who owns it. For CIOs and CISOs at mid-sized or lower-profile organisations, this undercuts a common comfort: the belief that attackers are unlikely to bother with them. The scanning is indiscriminate. Exposure, not identity, determines who gets tested, and anything reachable from the internet should expect to be probed repeatedly.
Takedowns are not the end of the story
The report’s third theme is that attacker infrastructure is increasingly able to regenerate. Activity linked to potential proxy-device recruitment quadrupled during the first half of the year. The recruits are often ordinary consumer devices such as phones and streaming boxes, which replenish the pool of infrastructure attackers can draw on.
Lumen points to IPIdea as an example. The proxy network rebuilt itself to nearly 112% of its previous size less than six months after a disruption effort. A takedown that was meant to cut capacity instead ended with a larger network. The implication for defenders is that disruption operations buy time but rarely deliver a lasting fix, and that security strategy cannot depend on a major takedown permanently removing a threat.
If attackers are faster and harder to dislodge, the question is where defenders can gain ground. Lumen’s answer is earlier visibility. Black Lotus Labs observed infrastructure tied to a recent exploitation campaign more than three weeks before the vulnerability was publicly identified. That lead time let researchers spot the activity ahead of traditional endpoint alerts or vendor disclosures.
Two priorities run through the findings, and both echo Keever’s comments. The first is reducing exposure. If edge devices are scanned thousands of times a day and campaigns can test more than 10,000 devices in weeks, every unnecessary internet-facing service and every lapse in configuration carries real risk. The second is moving detection earlier in the attack cycle, using intelligence sources that do not wait for a disclosure or an endpoint alert.
Neither piece of advice is new, but the data gives it urgency. Patch cadences designed for a slower era are now measured against attackers who can act within a day of disclosure and who use automation to keep pressure constant. For CIOs, the practical question is no longer whether attackers will find an exposed system, but how little time they will need to do it.